Use personal information lawfully

If you meet the criteria to apply the journalism exemption, you can rely on it to make sure your use of personal information is lawful, rather than relying on one of the usual data protection lawful bases, such as legitimate interests or consent. This section of the code sets out what the legislation says and how to comply when you are not applying the exemption (See Apply the journalism exemption).

What does the legislation say?

4.1 You must use personal information lawfully. This means relying on one of the six specific lawful bases in data protection law and acting in line with other laws.

4.2 In most day-to-day journalism, the legitimate interests lawful basis is likely to be the most appropriate basis. It often applies in a straight-forward way when you need to use personal information to pursue your legitimate interests and those interests are not outweighed by any harm caused to a person.

4.3 If you use the consent lawful basis, you must comply with the specific high standards and meaning of UK GDPR consent. There will often be circumstances where other lawful bases are likely to be more appropriate, in particular legitimate interests.

What does UK GDPR consent mean?

Consent has a specific legal meaning in the UK GDPR. It is different from asking someone as a general courtesy whether it is ok to use their personal information. The UK GDPR sets high standards for consent. Your request for consent must be easily accessible, clear and in plain language. You must provide consent by a positive, opt-in action that someone can easily withdraw at any time.

4.4 If you are offering an online service directly to children, such as a news website for children, only those aged 13 or over can provide UK GDPR consent. You should also consider our Children’s code of practice.

Sensitive types of personal information

4.5 There are some specific types of personal information that are more sensitive and merit additional protection in data protection law. These types of information are known as special category and criminal offence data.

4.6 If you are using special category data, you must have a lawful basis and meet a separate condition. For some of these, you must also meet additional conditions and safeguards that are set out in Schedule 1 of the DPA 2018.

4.7 If you are using criminal offence data, you must have a lawful basis and meet a relevant condition under Schedule 1 of the DPA 2018.

What is special category data?

Special category data is personal information revealing or concerning:

racial or ethnic origin;
political opinions;
religious or philosophical beliefs;
trade union membership;
genetic data;
biometric data (where used for identification);
health;
sex life; or
sexual orientation.

4.8 If you are using special category data, you must rely on one of the six lawful bases and meet a separate condition.

4.9 For some of the conditions that apply to special category data, you must also meet additional conditions and safeguards.

4.10 There are 10 conditions that can give you a valid reason for using special category data. Those most likely to be relevant to journalism are:

you have explicit consent;
the personal information is manifestly made public by the person it is about; or
there is a substantial public interest with a reason in law.

4.11 If you are considering the manifestly made public condition, personal information is made public if it is realistically accessible to a member of the public. This includes if it is only accessible to part of the public.

4.12 If you want to use the condition relating to a substantial public interest, there are 23 “substantial public interest conditions” that provide a valid reason in law.

4.13 There are two substantial public interest conditions that may be particularly relevant in a journalism context. One applies if you need to use personal information for the administration of justice because journalists have an important role in increasing the transparency of the justice system. Another applies when, in certain circumstances, personal information is disclosed to you for journalism in connection with unlawful acts and dishonesty.

4.14 If you want to use the substantial public interest condition concerning the administration of justice, you must have an Appropriate policy document (see 4.14 in Reference notes).

Criminal offence data

What is criminal offence data?

Criminal offence data covers a wide range of information about:

criminal activity;
allegations;
investigations;
proceedings;
penalties;
conditions or restrictions placed on someone as part of the criminal justice process; or
civil measures that may lead to a criminal penalty, if not adhered to.

4.15 If you are using criminal offence data, you must have a lawful basis and meet a relevant condition.

4.16 There are 28 conditions that allow you to use criminal offence data. Those most likely to be relevant to journalism are:

consent (this does not need to be explicit in the case of criminal offence data);
the personal information is necessary for the administration of justice;
personal information is disclosed for journalism relating to unlawful acts and dishonesty; and
personal information is manifestly made public by the person the personal information is about (see above).

How do we comply?

4.17 From the start, you should choose the lawful basis that appears to be most relevant in the circumstances and consider if more than one applies. It is likely to be unfair to change your lawful basis at a later stage (see Use personal information fairly).

4.18 The lawful basis most relevant to journalism is legitimate interests. The consent lawful basis is likely to be the next most common, but only applies when you are giving people genuine control over how you use their personal information and you meet the standards of UK GDPR consent.

The legitimate interests lawful basis

4.19 In most day-to-day journalism, the legitimate interests lawful basis is likely to be the most appropriate basis. It often applies in a straight-forward way when there is a legitimate interest in pursuing journalism and it is clear that this is not outweighed by the interests of the person the information is about.

4.20 In many cases, journalists do not need to do anything more than simply highlight privacy information, unless the journalism exemption applies (see Apply the journalism exemption). Most organisations publish a privacy notice on their website (see Use personal information transparently).

4.21 A legitimate interest may be a public interest or a commercial interest. For example, many media organisations are commercial enterprises with a legitimate interest in selling news. Much of the freedom of the press, its diversity, and the societal value we derive from it, depends on being commercially successful.

4.22 In the context of journalism, there is a public interest in the right to freedom of expression and information that is protected by the Human Rights Act 1998 (HRA). A free press is vital to exercising this right (see Apply the journalism exemption for more detail).

4.23 If it is not already obvious that you have a legitimate interest that is not outweighed by harm to a person, you should consider the specific circumstances in more detail. This includes whether there is another reasonable and less intrusive way to achieve the same result and you can justify any harm.

4.24 You should take extra care if:

there are significant risks involved (see Demonstrate how you comply);
you are using sensitive types of personal information, especially special category or criminal offence information (see below); or
you are using personal information about children or other people who may be less able to understand the risks (see Use personal information fairly).

The consent lawful basis

4.25 Although you are likely to rely on the legitimate interest lawful basis most often in a journalism context, you may sometimes use one of the other lawful bases, such as consent. For example, if you want to use sensitive types of personal information (see below).

4.26 Before deciding to rely on the consent lawful basis, you should consider whether it is the most appropriate basis. People can withdraw consent at any time which, in many circumstances, may be difficult in the context of journalism.

4.27 If you decide to use the consent lawful basis, you should take extra care with people less likely to understand consent, such as children. You should consider their competence to consent.

Special category personal data

4.28 Before you use special category data, you should consider why you want to use it. This will help you choose a lawful basis and condition, and where relevant, a further condition and safeguard.

4.29 If you want to use the explicit consent condition, you should make sure that the consent you receive is expressly affirmed in a clear statement, whether verbal or written.

4.30 If you want to use the condition relating to personal information that is manifestly made public, it should be clear and obvious that the person concerned has made the personal information publicly available. The use of the word “manifestly” reflects the specific, extra protection given to special category and criminal offence by data protection law (see also Use personal information fairly).

4.31 The condition about disclosures relating to unlawful acts and dishonesty may be relevant if a whistle-blower discloses information to you. You may need to consider whether the journalism exemption applies if you want to use the information (see Apply the journalism exemption).

Criminal offence personal data

4.32 Before you use any criminal offence data, you should consider why you want to use it. This will help you choose a relevant lawful basis and condition.

4.33 If you are considering the necessary for the administration of justice condition, you should remember that once a person is charged with a criminal offence, the open justice principle generally means you can identify the person charged.

Reference notes

These reference notes support the Data protection and journalism code of practice (the code) but are not part of the statutory code itself.

4.1 Six lawful bases

The six lawful bases available are:

legitimate interests;
consent;
contract;
legal obligation;
vital interests; and
public task.

4.13 Journalism relating to unlawful acts and dishonesty condition

This condition applies if special category data is disclosed for journalism by the person with legal responsibility for complying with data protection law and it relates to:

a person acting unlawfully;
dishonesty, malpractice or other seriously improper conduct of a person;
the unfitness or incompetence of a person; or
mismanagement or service failure by a body or association.

A person with legal responsibility for personal information can disclose it to you for journalism if they:

are disclosing it with a view to publication; and
reasonably believe that disclosure of the personal information would be in the public interest.

4.14 Appropriate policy document

An appropriate policy document is a short document outlining:

the schedule 1 condition (or conditions) you are relying on;
your procedures for complying with each of the data protection principles;
your retention and deletion policies; and
an indication of the retention period for the specified personal information.

Key legal provisions

UK GDPR article 5(1)(a) – the lawfulness, fairness and transparency principle
UK GDPR article 6 – lawfulness of processing
UK GDPR article 9 – processing of special category data
UK GDPR article 10 – processing of criminal offence data
UK GDPR articles 13 and 14 – right to be informed
UK GDPR article 17(1)(d) – right to erasure when personal data has been processed unlawfully
DPA 2018 Schedule 1, paragraphs 1-37 – conditions for processing criminal offence data
DPA 2018 part 2 of schedule 1 – substantial public interest conditions for special category data